Analysis
- max time kernel
144s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/02/2021, 07:08
General
- Target 07ac68fef8d90307874918f85d499b48ea2007b51f0bd404b5a35ba97a6c7dd8.exe
- Size 78KB
- Sample210228-k6tx6mvs2s
- SHA256 07ac68fef8d90307874918f85d499b48ea2007b51f0bd404b5a35ba97a6c7dd8
Score
10/10
Malware Config
Signatures
- MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ac68fef8d90307874918f85d499b48ea2007b51f0bd404b5a35ba97a6c7dd8.exe"C:\Users\Admin\AppData\Local\Temp\07ac68fef8d90307874918f85d499b48ea2007b51f0bd404b5a35ba97a6c7dd8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\smhk2iid.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E49.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5573FE4A52444FFBB16DCE4035DE28F1.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2D11.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2D11.tmp.exe" C:\Users\Admin\AppData\Local\Temp\07ac68fef8d90307874918f85d499b48ea2007b51f0bd404b5a35ba97a6c7dd8.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/708-14-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/708-15-0x0000000002F23000-0x0000000002F25000-memory.dmp
memory/992-11-0x0000000002350000-0x0000000002351000-memory.dmp
memory/4684-2-0x0000000002720000-0x0000000002721000-memory.dmp